when pulling out a library that can be released on its own to a maven repo (e.g. a REST API client) would that be a composite build or a module?

Up to you